AWS Elastic Beanstalk HTTPS not working

1
votes

I can browse to the web site with http but cannot with https, I get ERR_CONNECTION_REFUSED in Chrome.

My environment is an expressJS server on nodejs (64bit Amazon Linux 2015.09 v2.0) running on Elastic Beanstalk. I can telnet to the EC2 elastic public IP on port 80 but I cannot telnet on port 443, connection refused.

Steps taken to set up HTTPS

  1. I created an SSL cert via the AWS Certificate Manager and added the cert to the Load Balancer Listeners.

    Port Configuration:
    80 (HTTP) forwarding to 80 (HTTP) Stickiness: Disabled(Edit)

    443 (HTTPS, ACM Certificate: 1E21...) forwarding to 80 (HTTP) Stickiness: Disabled

  2. In the Load Balancer Security Group, I added inbound and outbound https traffic on port 443 Source 0.0.0.0/0.

  3. In my EC2 Elastic I.P, I selected my ExpressJS server instance and then added inbound and outbound https traffic on port 443 Source 0.0.0.0/0.

  4. In addition, I also added the Load Balancer Security Group to my ExpressJS server security because I read in another post that you had to associate the load balancer group with the server instance (not sure that this is required).

Any suggestions?

btw, does HTTPS traffic terminate at the Load Balancer and then unencrypted and handled internally on port 80 to the server?

1
amazon-web-servicessslexpressamazon-ec2amazon-elastic-beanstalk
Is your ElasticBeanstalk environment inside a VPC? - hephalump
Thanks for responding, I am new to AWS, how do I tell if my EB environment is in a VPC? - user3524762
@hephalump - When I look at the EC2 Dashboard and click on Elastic Public IP the scope is vpc. In addition, when I click on instance I see Secondary private IPs has a VPC ID - user3524762

1 Answers

6
votes

Solved it, turned out the mistake I made was that I added a record on my monster DNS for my AWS site and pointed it to the AWS Public Elastic IP as a A record, instead, I should have added the CNAME of my Load Balancer to the Monster DNS, once I did that, HTTPS was working.

I also ditched the Public Elastic IP as it was not required anymore, also, having the public I.P prevented me from taking advantage of the load balancer. Hope this helps other people.